elasticsearch/docs/reference/ml/stopping-ml.asciidoc

[role="xpack"]
[[stopping-ml]]
== Stopping machine learning

An orderly shutdown of {ml} ensures that:

* {dfeeds-cap} are stopped
* Buffers are flushed
* Model history is pruned
* Final results are calculated
* Model snapshots are saved
* Jobs are closed

This process ensures that jobs are in a consistent state in case you want to
subsequently re-open them.

[float]
[[stopping-ml-datafeeds]]
=== Stopping {dfeeds-cap}

When you stop a {dfeed}, it ceases to retrieve data from {es}. You can stop a
{dfeed} by using {kib} or the
{ref}/ml-stop-datafeed.html[stop {dfeeds} API]. For example, the following
request stops the `feed1` {dfeed}:

[source,js]
--------------------------------------------------
POST _ml/datafeeds/datafeed-total-requests/_stop
--------------------------------------------------
// CONSOLE
// TEST[skip:setup:server_metrics_startdf]

NOTE: You must have `manage_ml`, or `manage` cluster privileges to stop {dfeeds}.
For more information, see <<security-privileges>>.

A {dfeed} can be started and stopped multiple times throughout its lifecycle.

For examples of stopping {dfeeds} in {kib}, see <<ml-gs-job1-manage>>.

[float]
[[stopping-all-ml-datafeeds]]
==== Stopping All {dfeeds-cap}

If you are upgrading your cluster, you can use the following request to stop all
{dfeeds}:

[source,js]
----------------------------------
POST _ml/datafeeds/_all/_stop
----------------------------------
// CONSOLE
// TEST[skip:needs-licence]

[float]
[[closing-ml-jobs]]
=== Closing Jobs

When you close a job, it cannot receive data or perform analysis operations.
If a job is associated with a {dfeed}, you must stop the {dfeed} before you can
close the jobs. If the {dfeed} has an end date, the job closes automatically on
that end date.

You can close a job by using the {ref}/ml-close-job.html[close job API]. For
example, the following request closes the `job1` job:

[source,js]
--------------------------------------------------
POST _ml/anomaly_detectors/total-requests/_close
--------------------------------------------------
// CONSOLE
// TEST[skip:setup:server_metrics_openjob]

NOTE: You must have `manage_ml`, or `manage` cluster privileges to stop {dfeeds}.
For more information, see <<security-privileges>>.

A job can be opened and closed multiple times throughout its lifecycle.

[float]
[[closing-all-ml-datafeeds]]
==== Closing All Jobs

If you are upgrading your cluster, you can use the following request to close
all open jobs on the cluster:

[source,js]
----------------------------------
POST _ml/anomaly_detectors/_all/_close
----------------------------------
// CONSOLE
// TEST[skip:needs-licence]